CVE-2026-59254: n8n authz bypass leaks external

Q: Is CVE-2026-59254 actively exploited?

No confirmed active exploitation of CVE-2026-59254 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-59254?

1) Patch to n8n 2.28.1 or later, which fixes the scope-resolution bug per the vendor advisory. 2) Until patched, review and tighten project-editor role assignments — treat editor access as equivalent to secrets access until the fix is applied. 3) Audit External Secrets usage: identify which secrets are referenced in workflow node expressions and rotate any that may have been exposed to editors without explicit secrets permission. 4) Enable/verify workflow execution and audit logging to detect expressions that resolve external secret values. 5) Post-patch, re-verify that the secrets-access permission is actually enforced by testing with a non-privileged editor account before restoring normal access levels.

Q: What systems are affected by CVE-2026-59254?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation / orchestration pipelines, secrets management integrations.

Q: What is the CVSS score for CVE-2026-59254?

No CVSS score has been assigned yet.

CISO Take

n8n before 2.28.1 has a broken access control flaw where the External Secrets feature does not enforce its own permission scope: any authenticated project editor can reference a secret variable inside a node expression and get the plaintext value back, even without the explicit 'secrets access' grant meant to gate it. This matters because n8n is widely used as an AI agent orchestration layer, and organizations typically store LLM API keys, vector DB tokens, and other AI-service credentials in External Secrets specifically to avoid embedding them in workflows — this bug defeats that control from the inside. There's no CVSS score, EPSS data, KEV listing, or public exploit yet, and it requires an authenticated account with at least project-editor rights, so this is an insider-risk / over-permissioned-user issue rather than an internet-facing one, but the package's own track record (136 other CVEs, OpenSSF Scorecard 6.6/10) argues for treating n8n hardening as an ongoing program, not a one-off patch. Upgrade to n8n 2.28.1 or later immediately, and in the interim audit which users hold project-editor roles versus who actually needs secrets access, then review workflow expression logs and execution history for any external-secret references made by editors who shouldn't have that visibility.

Sources: NVD GitHub Advisory OpenSSF ATLAS

What is the risk?

Low-to-moderate exploitability (requires an authenticated project-editor account, not remote/unauthenticated access) but high-value impact if exploited, since the payload is plaintext credentials rather than data-at-rest. No CVSS/EPSS scoring is published and there is no known public exploit or Nuclei template, which lowers near-term opportunistic risk but does not reduce insider-threat or over-provisioned-account risk. Organizations that grant broad project-editor access (common in fast-moving automation/AI teams) or that store high-value AI/LLM API keys and cloud credentials in n8n's External Secrets feature carry the highest exposure.

How does the attack unfold?

Authenticated Access

Attacker obtains or already holds a low-privileged 'project editor' account in n8n, without explicit secrets-access permission.

AML.T0012

Scope Bypass

Editor references an External Secret variable inside a workflow node expression, which n8n incorrectly resolves outside the credentials permission scope.

AML.T0055

Credential Disclosure

The plaintext secret (e.g., an AI service API key) is displayed in the expression editor or execution output, fully exposing it to the unauthorized editor.

AML.T0083

Downstream Abuse

Attacker exfiltrates or reuses the leaked credential to access the AI service, other integrated systems, or run up unauthorized usage costs.

AML.T0024

Authenticated Access

Attacker obtains or already holds a low-privileged 'project editor' account in n8n, without explicit secrets-access permission.

AML.T0012

Scope Bypass

Editor references an External Secret variable inside a workflow node expression, which n8n incorrectly resolves outside the credentials permission scope.

AML.T0055

Credential Disclosure

The plaintext secret (e.g., an AI service API key) is displayed in the expression editor or execution output, fully exposing it to the unauthorized editor.

AML.T0083

Downstream Abuse

Attacker exfiltrates or reuses the leaked credential to access the AI service, other integrated systems, or run up unauthorized usage costs.

AML.T0024

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	>= 2.28.0, < 2.28.1	`2.28.1`
206.1K OpenSSF 6.7 Pushed 5d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.4%

chance of exploitation in 30 days

Higher than 28% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Patch to n8n 2.28.1 or later, which fixes the scope-resolution bug per the vendor advisory. 2) Until patched, review and tighten project-editor role assignments — treat editor access as equivalent to secrets access until the fix is applied. 3) Audit External Secrets usage: identify which secrets are referenced in workflow node expressions and rotate any that may have been exposed to editors without explicit secrets permission. 4) Enable/verify workflow execution and audit logging to detect expressions that resolve external secret values. 5) Post-patch, re-verify that the secrets-access permission is actually enforced by testing with a non-privileged editor account before restoring normal access levels.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Auth Bypass Privacy Violation Agent API AML.T0055 - Unsecured Credentials AML.T0083 - Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.8 - AI system data and asset security

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-59254?

n8n before 2.28.1 has a broken access control flaw where the External Secrets feature does not enforce its own permission scope: any authenticated project editor can reference a secret variable inside a node expression and get the plaintext value back, even without the explicit 'secrets access' grant meant to gate it. This matters because n8n is widely used as an AI agent orchestration layer, and organizations typically store LLM API keys, vector DB tokens, and other AI-service credentials in External Secrets specifically to avoid embedding them in workflows — this bug defeats that control from the inside. There's no CVSS score, EPSS data, KEV listing, or public exploit yet, and it requires an authenticated account with at least project-editor rights, so this is an insider-risk / over-permissioned-user issue rather than an internet-facing one, but the package's own track record (136 other CVEs, OpenSSF Scorecard 6.6/10) argues for treating n8n hardening as an ongoing program, not a one-off patch. Upgrade to n8n 2.28.1 or later immediately, and in the interim audit which users hold project-editor roles versus who actually needs secrets access, then review workflow expression logs and execution history for any external-secret references made by editors who shouldn't have that visibility.

Is CVE-2026-59254 actively exploited?

No confirmed active exploitation of CVE-2026-59254 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-59254?

1) Patch to n8n 2.28.1 or later, which fixes the scope-resolution bug per the vendor advisory. 2) Until patched, review and tighten project-editor role assignments — treat editor access as equivalent to secrets access until the fix is applied. 3) Audit External Secrets usage: identify which secrets are referenced in workflow node expressions and rotate any that may have been exposed to editors without explicit secrets permission. 4) Enable/verify workflow execution and audit logging to detect expressions that resolve external secret values. 5) Post-patch, re-verify that the secrets-access permission is actually enforced by testing with a non-privileged editor account before restoring normal access levels.

What systems are affected by CVE-2026-59254?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation / orchestration pipelines, secrets management integrations.

What is the CVSS score for CVE-2026-59254?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation / orchestration pipelinessecrets management integrations

MITRE ATLAS Techniques

AML.T0055 Unsecured Credentials

AML.T0083 Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.8

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authenticated project editors can read plaintext external secret values by referencing them in node expressions without requiring explicit secrets access permissions.

Exploitation Scenario

An organization onboards a contractor or junior team member as a 'project editor' in n8n to build AI agent workflows, deliberately withholding the separate 'secrets access' permission because they should only need to build logic, not see credentials. The editor creates or edits a node expression that references an External Secret variable (e.g., an Anthropic or OpenAI API key configured for the AI agent nodes) — n8n resolves and displays the plaintext value in the expression editor or execution output, even though the editor was never granted secrets access. The user copies the key and uses it directly against the LLM provider's API outside of n8n, incurring unauthorized usage costs, exfiltrating data processed by the agent, or using the credential to pivot into other systems the key has access to.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.